分析任务

分析类型 虚拟机标签 开始时间 结束时间 持续时间
文件 (Windows) win7-sp1-x64-hpdapp01-1 2019-06-03 00:08:42 2019-06-03 00:11:03 141 秒

魔盾分数

7.85

危险的

文件详细信息

文件名 战神挑战助手.exe
文件大小 1937408 字节
文件类型 PE32 executable (GUI) Intel 80386, for MS Windows
MD5 03a276036fe4c755392547e24d9981eb
SHA1 f84605a8e4c1d8cbadc496d81fa50ec1a2732a19
SHA256 4f9af8541748578e2756096c0e195f406be2bbe9a88332940fe799c51fdeefb2
SHA512 f7b4f733edf1bf079d58bb4976222cf1612bb59696c0e4442fc42d928ef8f3de90414e0fa1f386002e08ec1882eca99316fe1f93503646a8a3c33de3e4d69aba
CRC32 6309696B
Ssdeep 24576:+s6k9+fUwUQ9mZ6iz3nPwbdkz9ZyV/5Cnct1/Au5G9P0MxkG7Wj:+sFdwUQ94oC9ZI/B1/xG9PtjWj
Yara 登录查看Yara规则
样本下载 提交误报

登录查看威胁特征

运行截图


访问主机纪录 (可点击查询WPING实时安全评级)

无主机纪录.

域名解析 (可点击查询WPING实时安全评级)

无域名信息.


摘要

登录查看详细行为信息

PE 信息

初始地址 0x00400000
入口地址 0x004730c7
声明校验值 0x00000000
实际校验值 0x001d917a
最低操作系统版本要求 4.0
编译时间 2019-06-02 21:27:31
载入哈希 da235dfbbb688ad53f3387fe9d31f249

版本信息

LegalCopyright
FileVersion
Comments
ProductName
ProductVersion
FileDescription
Translation

PE 数据组成

名称 虚拟地址 虚拟大小 原始数据大小 特征 熵(Entropy)
.text 0x00001000 0x00091e06 0x00092000 IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ 6.56
.rdata 0x00093000 0x001282b0 0x00129000 IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ 6.24
.data 0x001bc000 0x00044028 0x00016000 IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE 5.49
.rsrc 0x00201000 0x000060d4 0x00007000 IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ 4.51

导入

库: KERNEL32.dll:
0x49318c SetEndOfFile
0x493190 UnlockFile
0x493194 LockFile
0x493198 FlushFileBuffers
0x49319c SetFilePointer
0x4931a0 DuplicateHandle
0x4931a4 lstrcpynA
0x4931a8 SetLastError
0x4931b4 LocalFree
0x4931bc CreateFileMappingA
0x4931c0 MapViewOfFile
0x4931c4 UnmapViewOfFile
0x4931c8 OpenFileMappingA
0x4931cc ReleaseMutex
0x4931d0 WideCharToMultiByte
0x4931d4 MultiByteToWideChar
0x4931d8 GetCurrentProcess
0x4931dc SetStdHandle
0x4931e0 IsBadCodePtr
0x4931e4 IsBadReadPtr
0x4931e8 CompareStringW
0x4931ec CompareStringA
0x4931f4 GetStringTypeW
0x4931f8 GetStringTypeA
0x4931fc IsBadWritePtr
0x493200 VirtualAlloc
0x493204 LCMapStringW
0x493208 LCMapStringA
0x493210 VirtualFree
0x493214 HeapCreate
0x493218 HeapDestroy
0x493220 GetFileType
0x493224 GetStdHandle
0x493228 SetHandleCount
0x493240 GetACP
0x493244 HeapSize
0x493248 TerminateProcess
0x49324c GetLocalTime
0x493254 GetSystemDirectoryA
0x493258 CreateSemaphoreA
0x49325c ResumeThread
0x493260 ReleaseSemaphore
0x49326c GetProfileStringA
0x493270 WriteFile
0x493278 CreateFileA
0x49327c SetEvent
0x493280 FindResourceA
0x493284 LoadResource
0x493288 LockResource
0x49328c ReadFile
0x493290 GetModuleFileNameA
0x493294 GetCurrentThreadId
0x493298 ExitProcess
0x49329c GlobalSize
0x4932a0 GlobalFree
0x4932ac lstrcatA
0x4932b0 lstrlenA
0x4932b4 WinExec
0x4932b8 lstrcpyA
0x4932bc FindNextFileA
0x4932c0 GlobalReAlloc
0x4932c4 HeapFree
0x4932c8 HeapReAlloc
0x4932cc GetProcessHeap
0x4932d0 HeapAlloc
0x4932d4 GetFullPathNameA
0x4932d8 FreeLibrary
0x4932dc LoadLibraryA
0x4932e0 GetLastError
0x4932e4 GetVersionExA
0x4932ec CreateThread
0x4932f0 CreateEventA
0x4932f4 Sleep
0x4932fc GetSystemTime
0x493304 RaiseException
0x493308 RtlUnwind
0x49330c GetStartupInfoA
0x493310 GetOEMCP
0x493314 GetCPInfo
0x493318 GetProcessVersion
0x49331c SetErrorMode
0x493320 GlobalFlags
0x493324 GetCurrentThread
0x493328 GetFileTime
0x49332c GetFileSize
0x493330 TlsGetValue
0x493334 LocalReAlloc
0x493338 TlsSetValue
0x49333c TlsFree
0x493340 GlobalHandle
0x493344 TlsAlloc
0x493348 LocalAlloc
0x49334c lstrcmpA
0x493350 GetVersion
0x493354 GlobalGetAtomNameA
0x493358 GlobalAlloc
0x49335c GlobalLock
0x493360 GlobalUnlock
0x493364 GetTempPathA
0x493368 FindFirstFileA
0x49336c FindClose
0x493370 GetFileAttributesA
0x493374 DeleteFileA
0x493378 CopyFileA
0x493384 GetModuleHandleA
0x493388 GetProcAddress
0x49338c MulDiv
0x493390 GetCommandLineA
0x493394 GetTickCount
0x493398 CreateProcessA
0x49339c WaitForSingleObject
0x4933a0 CloseHandle
0x4933a4 GlobalAddAtomA
0x4933a8 GlobalFindAtomA
0x4933ac GlobalDeleteAtom
0x4933b0 lstrcmpiA
库: USER32.dll:
0x4933dc WaitForInputIdle
0x4933e0 wsprintfA
0x4933e4 CloseClipboard
0x4933e8 GetClipboardData
0x4933ec OpenClipboard
0x4933f0 SetClipboardData
0x4933f4 EmptyClipboard
0x4933f8 GetSystemMetrics
0x4933fc GetCursorPos
0x493400 MessageBoxA
0x493404 SetWindowPos
0x493408 SendMessageA
0x49340c DestroyCursor
0x493410 SetParent
0x493414 IsWindow
0x493418 PostMessageA
0x49341c GetTopWindow
0x493420 GetParent
0x493424 GetFocus
0x493428 GetClientRect
0x49342c InvalidateRect
0x493430 ValidateRect
0x493434 UpdateWindow
0x493438 EqualRect
0x49343c GetWindowRect
0x493440 SetForegroundWindow
0x493444 DestroyMenu
0x493448 IsChild
0x49344c ReleaseDC
0x493450 IsRectEmpty
0x493454 FillRect
0x493458 GetDC
0x49345c SetCursor
0x493460 LoadCursorA
0x493464 SetCursorPos
0x493468 SetActiveWindow
0x49346c GetSysColor
0x493470 SetWindowLongA
0x493474 GetWindowLongA
0x493478 RedrawWindow
0x49347c EnableWindow
0x493480 IsWindowVisible
0x493484 OffsetRect
0x493488 PtInRect
0x49348c DestroyIcon
0x493490 IntersectRect
0x493494 InflateRect
0x493498 SetRect
0x49349c SetScrollPos
0x4934a0 SetScrollRange
0x4934a4 GetScrollRange
0x4934a8 SetCapture
0x4934ac GetCapture
0x4934b0 ReleaseCapture
0x4934b4 SetTimer
0x4934b8 GetForegroundWindow
0x4934bc LoadIconA
0x4934c0 TranslateMessage
0x4934c4 DrawFrameControl
0x4934c8 DrawEdge
0x4934cc DrawFocusRect
0x4934d0 WindowFromPoint
0x4934d4 GetMessageA
0x4934d8 DispatchMessageA
0x4934dc SetRectEmpty
0x4934ec DrawIconEx
0x4934f0 CreatePopupMenu
0x4934f4 AppendMenuA
0x4934f8 ModifyMenuA
0x4934fc CreateMenu
0x493504 GetDlgCtrlID
0x493508 GetSubMenu
0x49350c EnableMenuItem
0x493510 ClientToScreen
0x493518 LoadImageA
0x493520 ShowWindow
0x493524 IsWindowEnabled
0x49352c GetKeyState
0x493534 PostQuitMessage
0x493538 IsZoomed
0x49353c GetClassInfoA
0x493540 DefWindowProcA
0x493544 GetWindowTextA
0x49354c CharUpperA
0x493550 GetWindowDC
0x493554 BeginPaint
0x493558 EndPaint
0x49355c TabbedTextOutA
0x493560 DrawTextA
0x493564 GrayStringA
0x493568 GetDlgItem
0x49356c DestroyWindow
0x493574 EndDialog
0x493578 GetNextDlgTabItem
0x49357c GetWindowPlacement
0x493584 GetLastActivePopup
0x493588 GetMessageTime
0x49358c RemovePropA
0x493590 CallWindowProcA
0x493594 GetPropA
0x493598 UnhookWindowsHookEx
0x49359c SetPropA
0x4935a0 GetClassLongA
0x4935a4 CallNextHookEx
0x4935a8 SetWindowsHookExA
0x4935ac CreateWindowExA
0x4935b0 GetMenuItemID
0x4935b4 GetMenuItemCount
0x4935b8 RegisterClassA
0x4935bc GetScrollPos
0x4935c0 UnregisterClassA
0x4935c4 AdjustWindowRectEx
0x4935c8 MapWindowPoints
0x4935cc SendDlgItemMessageA
0x4935d0 ScrollWindowEx
0x4935d4 IsDialogMessageA
0x4935d8 SetWindowTextA
0x4935dc MoveWindow
0x4935e0 CheckMenuItem
0x4935e4 SetMenuItemBitmaps
0x4935e8 GetMenuState
0x4935f0 GetClassNameA
0x4935f4 GetDesktopWindow
0x4935f8 LoadStringA
0x4935fc GetSysColorBrush
0x493600 GetSystemMenu
0x493604 DeleteMenu
0x493608 GetMenu
0x49360c SetMenu
0x493610 PeekMessageA
0x493614 IsIconic
0x493618 SetFocus
0x49361c GetActiveWindow
0x493620 GetWindow
0x493628 SetWindowRgn
0x49362c GetMessagePos
0x493630 ScreenToClient
0x493638 CopyRect
0x49363c LoadBitmapA
0x493640 WinHelpA
0x493644 KillTimer
库: GDI32.dll:
0x493040 SelectClipRgn
0x493044 DeleteObject
0x493048 CreateDIBitmap
0x493050 CreatePalette
0x493054 StretchBlt
0x493058 SelectPalette
0x49305c RealizePalette
0x493060 GetDIBits
0x493064 GetWindowExtEx
0x493068 GetViewportOrgEx
0x49306c GetWindowOrgEx
0x493070 BeginPath
0x493074 EndPath
0x493078 PathToRegion
0x49307c CreateEllipticRgn
0x493080 CreateRoundRectRgn
0x493084 GetTextColor
0x493088 GetBkMode
0x49308c GetBkColor
0x493090 GetROP2
0x493094 GetStretchBltMode
0x493098 GetPolyFillMode
0x4930a0 CreateDCA
0x4930a4 CreateBitmap
0x4930a8 SelectObject
0x4930ac GetObjectA
0x4930b0 CreatePen
0x4930b4 CreatePolygonRgn
0x4930b8 CombineRgn
0x4930bc CreateRectRgn
0x4930c0 FillRgn
0x4930c4 CreateSolidBrush
0x4930c8 GetStockObject
0x4930cc CreateFontIndirectA
0x4930d0 EndPage
0x4930d4 EndDoc
0x4930d8 DeleteDC
0x4930dc StartDocA
0x4930e0 StartPage
0x4930e4 BitBlt
0x4930e8 CreateCompatibleDC
0x4930ec Ellipse
0x4930f0 Rectangle
0x4930f4 LPtoDP
0x4930f8 DPtoLP
0x4930fc GetCurrentObject
0x493100 RoundRect
0x493108 GetDeviceCaps
0x49310c SaveDC
0x493110 RestoreDC
0x493114 SetBkMode
0x493118 SetPolyFillMode
0x49311c SetROP2
0x493120 SetTextColor
0x493124 SetMapMode
0x493128 SetViewportOrgEx
0x49312c OffsetViewportOrgEx
0x493130 SetViewportExtEx
0x493134 ScaleViewportExtEx
0x493138 SetWindowOrgEx
0x49313c SetWindowExtEx
0x493140 ScaleWindowExtEx
0x493144 GetClipBox
0x493148 ExcludeClipRect
0x49314c MoveToEx
0x493150 LineTo
0x493154 GetClipRgn
0x493158 SetStretchBltMode
0x493160 SetBkColor
0x493164 PatBlt
0x493168 GetTextMetricsA
0x49316c Escape
0x493170 ExtTextOutA
0x493174 TextOutA
0x493178 RectVisible
0x49317c PtVisible
0x493180 GetViewportExtEx
0x493184 ExtSelectClipRgn
库: WINMM.dll:
0x49364c midiStreamRestart
0x493650 midiStreamClose
0x493654 midiOutReset
0x493658 midiStreamStop
0x49365c midiStreamOut
0x493664 midiStreamProperty
0x493668 midiStreamOpen
0x493670 waveOutOpen
0x493674 waveOutGetNumDevs
0x493678 waveOutClose
0x49367c waveOutReset
0x493680 waveOutPause
0x493684 waveOutWrite
库: WINSPOOL.DRV:
0x493694 ClosePrinter
0x493698 DocumentPropertiesA
0x49369c OpenPrinterA
库: ADVAPI32.dll:
0x493000 RegQueryValueExA
0x493004 RegOpenKeyExA
0x493008 RegSetValueExA
0x49300c RegDeleteValueA
0x493010 RegDeleteKeyA
0x493014 RegQueryValueA
0x493020 RegOpenKeyA
0x493024 RegEnumKeyA
0x493028 RegCreateKeyExA
0x49302c RegCloseKey
库: SHELL32.dll:
0x4933cc ShellExecuteA
0x4933d0 Shell_NotifyIconA
库: ole32.dll:
0x4936e8 OleUninitialize
0x4936ec CLSIDFromString
0x4936f0 OleInitialize
库: OLEAUT32.dll:
0x4933bc UnRegisterTypeLib
0x4933c0 RegisterTypeLib
0x4933c4 LoadTypeLib
库: COMCTL32.dll:
0x493034 None
0x493038 ImageList_Destroy
库: WS2_32.dll:
0x4936a4 recvfrom
0x4936a8 ioctlsocket
0x4936ac recv
0x4936b0 getpeername
0x4936b4 accept
0x4936b8 ntohs
0x4936bc htons
0x4936c0 WSAAsyncSelect
0x4936c4 closesocket
0x4936c8 WSACleanup
0x4936cc inet_ntoa
库: comdlg32.dll:
0x4936d4 GetFileTitleA
0x4936d8 GetSaveFileNameA
0x4936dc GetOpenFileNameA
0x4936e0 ChooseColorA

.text
`.rdata
@.data
.rsrc
VMProtect begin
VMProtect begin
VMProtect end
VMProtect end
Ph(}Z
Ph@}Z
Ph@}Z
Ph@}Z
Ph@}Z
8`}<j
T$th
|$tVj
D$@Sj
L$8h
D$8Rj
l$<VWj
T$ Rj
L$4S+L$0Qj
没有防病毒引擎扫描信息!

进程树


__________________.exe, PID: 2652, 上一级进程 PID: 2300

访问主机纪录 (可点击查询WPING实时安全评级)

无主机纪录.

TCP

无TCP连接纪录.

UDP

无UDP连接纪录.

域名解析 (可点击查询WPING实时安全评级)

无域名信息.

TCP

无TCP连接纪录.

UDP

无UDP连接纪录.

HTTP 请求

未发现HTTP请求.

SMTP 流量

无SMTP流量.

IRC 流量

无IRC请求.

ICMP 流量

无ICMP流量.

CIF 报告

无 CIF 结果

网络警报

无警报

TLS

No TLS

Suricata HTTP

No Suricata HTTP

未发现网络提取文件
抱歉! 没有任何文件投放。
没有发现相似的分析.
HTML 总结报告
(需15-60分钟同步)
下载

Processing ( 29.677 seconds )

  • 15.54 Suricata
  • 7.253 Static
  • 4.165 TargetInfo
  • 1.438 VirusTotal
  • 0.465 peid
  • 0.35 NetworkAnalysis
  • 0.315 BehaviorAnalysis
  • 0.127 AnalysisInfo
  • 0.015 Strings
  • 0.006 config_decoder
  • 0.003 Memory

Signatures ( 0.229 seconds )

  • 0.028 antiav_detectreg
  • 0.016 api_spamming
  • 0.016 md_domain_bl
  • 0.014 md_url_bl
  • 0.012 stealth_timeout
  • 0.012 infostealer_ftp
  • 0.011 stealth_decoy_document
  • 0.008 anomaly_persistence_autorun
  • 0.007 antiav_detectfile
  • 0.007 infostealer_im
  • 0.006 antianalysis_detectreg
  • 0.006 ransomware_files
  • 0.005 infostealer_bitcoin
  • 0.005 ransomware_extensions
  • 0.004 antiemu_wine_func
  • 0.004 kovter_behavior
  • 0.004 infostealer_mail
  • 0.003 tinba_behavior
  • 0.003 antivm_vbox_libs
  • 0.003 rat_nanocore
  • 0.003 infostealer_browser_password
  • 0.003 antidbg_windows
  • 0.003 antivm_vbox_files
  • 0.003 geodo_banking_trojan
  • 0.003 disables_browser_warn
  • 0.002 antivm_generic_services
  • 0.002 betabot_behavior
  • 0.002 antivm_generic_scsi
  • 0.002 exec_crash
  • 0.002 cerber_behavior
  • 0.002 browser_security
  • 0.002 modify_proxy
  • 0.002 md_bad_drop
  • 0.001 network_tor
  • 0.001 antiav_avast_libs
  • 0.001 antivm_vmware_libs
  • 0.001 ursnif_behavior
  • 0.001 antisandbox_sunbelt_libs
  • 0.001 dyre_behavior
  • 0.001 kibex_behavior
  • 0.001 shifu_behavior
  • 0.001 anormaly_invoke_kills
  • 0.001 antianalysis_detectfile
  • 0.001 antidbg_devices
  • 0.001 antivm_generic_diskreg
  • 0.001 antivm_parallels_keys
  • 0.001 antivm_xen_keys
  • 0.001 banker_zeus_mutex
  • 0.001 bot_drive
  • 0.001 bot_drive2
  • 0.001 browser_addon
  • 0.001 disables_system_restore
  • 0.001 disables_windows_defender
  • 0.001 darkcomet_regkeys
  • 0.001 recon_fingerprint
  • 0.001 stealth_hide_notifications
  • 0.001 stealth_modify_uac_prompt

Reporting ( 1.294 seconds )

  • 0.934 ReportHTMLSummary
  • 0.36 Malheur
Task ID 300217
Mongo ID 5cf3f53b2f8f2e1a35d46e74
Cuckoo release 1.4-Maldun